For the past few days, Google shows an "unusual traffic" warning whenever I search from my phone without signing in. It only happens while connected to my home Wi‑Fi; cellular data works normally. I do not use a VPN or iCloud Private Relay. I'm worried that malware on one of the devices in the house might be causing it, although the computers run Linux and the phones use iOS, and everyone is generally careful about downloads. I unplugged the modem for several hours hoping the public IP would change, but it stayed the same. Is there a way to determine what is triggering Google's warning, and what should I check with my router or internet provider?
4 Answers
Ask your internet provider whether your connection is behind CGNAT. With CGNAT, many customers share one public IPv4 address. If another customer using that same address sends traffic Google dislikes, your searches can trigger the warning too. The provider may be able to move you to another address or explain whether this is happening.
You can still do a basic security check—update the router firmware, review connected devices, change the Wi‑Fi password if anything looks unfamiliar, and run malware scans—but the warning by itself is not proof that one of your machines is infected. Since the issue affects the home connection rather than one particular device, an IP reputation or shared-address problem is more likely.
This may not be caused by anything on your devices. Google can temporarily flag an IP address when it sees unusually high traffic from it, and similar reports can happen even when users do not use a VPN or notice anything suspicious. It may clear up by itself after Google’s systems stop treating the address as suspicious.
The addresses assigned to devices by your router are private internal addresses. They are different from the single public address that websites see for the whole household. Adding or changing those internal addresses will not fix a Google warning tied to the public address, and “public IP” does not mean public Wi‑Fi.
Restarting the modem does not necessarily give you a new public address, especially if the ISP leases the same one again or uses CGNAT. The provider is the right place to ask about that.